<html>
<head><meta charset="utf-8"><title>Reproducible builds · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html">Reproducible builds</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="151798219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151798219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151798219">(Dec 14 2018 at 19:24)</a>:</h4>
<p>Somebody managed to bootstrap rustc from mrustc. It's not fully reproducible yet, but definitely a step in the right direction. <a href="https://www.gnu.org/software/guix/blog/2018/bootstrapping-rust/" target="_blank" title="https://www.gnu.org/software/guix/blog/2018/bootstrapping-rust/">https://www.gnu.org/software/guix/blog/2018/bootstrapping-rust/</a></p>



<a name="151799171"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151799171" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151799171">(Dec 14 2018 at 19:37)</a>:</h4>
<p>neat</p>



<a name="151799227"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151799227" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151799227">(Dec 14 2018 at 19:38)</a>:</h4>
<p>also re: the overall topic, if anyone knows the state of <code>rustc</code> in that regard, I'm curious</p>



<a name="151799247"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151799247" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151799247">(Dec 14 2018 at 19:38)</a>:</h4>
<p>They discuss it briefly in the blog post</p>



<a name="151799272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151799272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151799272">(Dec 14 2018 at 19:39)</a>:</h4>
<p>"Rust takes reproducible builds seriously, but there are some reproducibility problems left in earlier compilers that pop up very sporadically (mostly because of LLVM, and some because of Rust hashtable poisoning). Help wanted, especially from LLVM people!"</p>



<a name="151799284"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/151799284" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#151799284">(Dec 14 2018 at 19:39)</a>:</h4>
<p>more specifically I'd be curious about a QEMU (or otherwise) recipe which, given a cargo project, always produces the same binary, byte-for-byte</p>



<a name="154524210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154524210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154524210">(Jan 06 2019 at 17:37)</a>:</h4>
<p>Anyone familiar with <code>reprotest</code>?</p>



<a name="154524216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154524216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154524216">(Jan 06 2019 at 17:37)</a>:</h4>
<p>it looks very interesting but I can't find any information about it</p>



<a name="154524263"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154524263" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154524263">(Jan 06 2019 at 17:38)</a>:</h4>
<p>here's something using it <a href="https://github.com/kpcyrd/sniffglue/blob/master/ci/reprotest.sh" target="_blank" title="https://github.com/kpcyrd/sniffglue/blob/master/ci/reprotest.sh">https://github.com/kpcyrd/sniffglue/blob/master/ci/reprotest.sh</a></p>



<a name="154524269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154524269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154524269">(Jan 06 2019 at 17:38)</a>:</h4>
<p>I guess it's this? <a href="https://pypi.org/project/reprotest/" target="_blank" title="https://pypi.org/project/reprotest/">https://pypi.org/project/reprotest/</a></p>



<a name="154534529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154534529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154534529">(Jan 06 2019 at 22:51)</a>:</h4>
<p>Question: if I make a binary with a Cargo.lock in the repo, and then publish that binary to <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a>, does that Cargo.lock propagate to users, or whenever someone types <code>cargo install my-program</code> they actually get latest semver-compatible versions?</p>



<a name="154534639"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154534639" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154534639">(Jan 06 2019 at 22:54)</a>:</h4>
<p>You can't publish binaries to <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a> at all, can you? I'd assume any <code>Cargo.lock</code> you have around is ignored.</p>



<a name="154535061"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154535061" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154535061">(Jan 06 2019 at 23:06)</a>:</h4>
<p>Right. I meant executables that are built from source on the user's machine. So Cargo.lock is not included in the upload to <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a>?</p>



<a name="154577503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/154577503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#154577503">(Jan 07 2019 at 15:38)</a>:</h4>
<p>no, it can't be because Cargo.lock's resolution depends on the constraints of all of the other dependencies</p>



<a name="156336727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156336727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156336727">(Jan 18 2019 at 01:32)</a>:</h4>
<p>You can definitely publish binary components in crates, without source code. It is done by some crates. The only requirement is that your Cargo.toml must generate something; you can include whatever else you want.</p>



<a name="156336933"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156336933" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156336933">(Jan 18 2019 at 01:37)</a>:</h4>
<p>so like, I can have a binary embedded, a hello world source code, a <a href="http://build.rs" target="_blank" title="http://build.rs">build.rs</a> that copies my binary to target/release, and everything is fine and dandy and I can push that to <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a>?</p>



<a name="156337014"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337014" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337014">(Jan 18 2019 at 01:38)</a>:</h4>
<p>I don't know about that. Probably your <a href="http://build.rs" target="_blank" title="http://build.rs">build.rs</a> has to build an executable. But you can have another executable included that it copies to the output and executes, I think.</p>



<a name="156337021"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337021" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337021">(Jan 18 2019 at 01:38)</a>:</h4>
<p>ewww, gross</p>



<a name="156337035"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337035" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337035">(Jan 18 2019 at 01:39)</a>:</h4>
<p>I know you can have binary libraries (*.a) that you ship in your crate, for example.</p>



<a name="156337040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337040">(Jan 18 2019 at 01:39)</a>:</h4>
<p>on the other hand, I don't know what I expected</p>



<a name="156337049"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337049" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337049">(Jan 18 2019 at 01:40)</a>:</h4>
<p>My understanding is that the new golang build/module system will require that what is in github matches what you have.</p>



<a name="156337111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337111">(Jan 18 2019 at 01:40)</a>:</h4>
<p>But, even then, I don't know if it lets you put your *.a and *.exe files in github and then says "OK". I'm guessing not.</p>



<a name="156337187"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337187" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337187">(Jan 18 2019 at 01:42)</a>:</h4>
<p>I will bypass any heuristics they make up</p>



<a name="156337194"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156337194" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156337194">(Jan 18 2019 at 01:42)</a>:</h4>
<p>the only thing that could sorta-reliably stop it is manual review</p>



<a name="156347190"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156347190" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156347190">(Jan 18 2019 at 06:14)</a>:</h4>
<p>there are like</p>



<a name="156347193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156347193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156347193">(Jan 18 2019 at 06:14)</a>:</h4>
<p>two concurrent threads I was trying to get to cross streams, heh</p>



<a name="156347198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156347198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156347198">(Jan 18 2019 at 06:14)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span>'s embedding Cargo.lock and such in binaries</p>



<a name="156347209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156347209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156347209">(Jan 18 2019 at 06:15)</a>:</h4>
<p>and this one: <a href="https://github.com/rust-lang/cargo/issues/5654" target="_blank" title="https://github.com/rust-lang/cargo/issues/5654">https://github.com/rust-lang/cargo/issues/5654</a></p>



<a name="156347212"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156347212" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156347212">(Jan 18 2019 at 06:15)</a>:</h4>
<p>because I think you can take <span class="user-mention" data-user-id="127617">@Shnatsel</span>'s thing and put it in a crate and solve ^^^ problem</p>



<a name="156637578"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/156637578" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#156637578">(Jan 22 2019 at 20:41)</a>:</h4>
<p>anyone familiar with <code>guix challenge</code>? <a href="https://www.gnu.org/software/guix/manual/en/html_node/Invoking-guix-challenge.html" target="_blank" title="https://www.gnu.org/software/guix/manual/en/html_node/Invoking-guix-challenge.html">https://www.gnu.org/software/guix/manual/en/html_node/Invoking-guix-challenge.html</a></p>



<a name="165980837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/165980837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#165980837">(May 18 2019 at 16:19)</a>:</h4>
<p>Well, I made a repo/crate for this: <a href="https://github.com/rust-secure-code/cargo-repro" target="_blank" title="https://github.com/rust-secure-code/cargo-repro">https://github.com/rust-secure-code/cargo-repro</a></p>



<a name="165980846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/165980846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#165980846">(May 18 2019 at 16:19)</a>:</h4>
<p>it doesn't do anything yet <span aria-label="wink" class="emoji emoji-1f609" role="img" title="wink">:wink:</span></p>



<a name="165980849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/165980849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#165980849">(May 18 2019 at 16:19)</a>:</h4>
<p>would love to gather input here: <a href="https://github.com/rust-secure-code/cargo-repro/issues/3" target="_blank" title="https://github.com/rust-secure-code/cargo-repro/issues/3">https://github.com/rust-secure-code/cargo-repro/issues/3</a></p>



<a name="166077889"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166077889" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> DevQps <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166077889">(May 20 2019 at 11:46)</a>:</h4>
<p>Nice! I just came back from vacation. Just some questions to get a good feeling for the goal of this tool (I might have missed some prior conversations here and there :))</p>
<p>Is it used to check if packages are the same (as in: project code and .zip archives downloaded from <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a>) or to check if binaries are the same? Or even mixes between them? (Like to check if an archive outputs the same binary?)</p>
<p>Of course I guess checking binaries really depends on the compiler that is used right?</p>



<a name="166087074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166087074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166087074">(May 20 2019 at 13:58)</a>:</h4>
<p>to me it's two parts:</p>



<a name="166087220"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166087220" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166087220">(May 20 2019 at 14:00)</a>:</h4>
<p>1) building binaries which are reproducible, and gathering the necessary environmental information to reproduce them. the former part is largely just <code>cargo build --locked</code> but I think such a tool should try to collect any potential sources of nondeterminism and potentially encode them into the resulting binary</p>



<a name="166087289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166087289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166087289">(May 20 2019 at 14:01)</a>:</h4>
<p>2) verifying a build is actually reproducible, given the source tree it was built from as a cargo project. there's <code>reprotest</code> for this, but it's a bit cumbersome to use and also trying to be a general purpose reproducible build utility</p>



<a name="166087381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166087381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166087381">(May 20 2019 at 14:02)</a>:</h4>
<p>mostly the problem to me is reproducible builds in Rust right now seem pretty cargo cult and I haven't even gotten one to work myself yet, so I'd like a tool that at least encodes the "recipe" for doing so somewhere other than a bunch of forum posts and GitHub issues</p>



<a name="166087393"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/166087393" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#166087393">(May 20 2019 at 14:02)</a>:</h4>
<p>"cargo cult" yeesh unintentional pun <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<a name="173040536"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/173040536" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#173040536">(Aug 12 2019 at 17:02)</a>:</h4>
<p>some very, very preliminary functionality in this PR: <a href="https://github.com/rust-secure-code/cargo-repro/pull/5" target="_blank" title="https://github.com/rust-secure-code/cargo-repro/pull/5">https://github.com/rust-secure-code/cargo-repro/pull/5</a></p>



<a name="182400303"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/182400303" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#182400303">(Dec 02 2019 at 23:22)</a>:</h4>
<p>so we're working on something... mildly ambitious in this department <a href="https://github.com/iqlusioninc/synchronicity" target="_blank" title="https://github.com/iqlusioninc/synchronicity">https://github.com/iqlusioninc/synchronicity</a></p>



<a name="182400336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/182400336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#182400336">(Dec 02 2019 at 23:23)</a>:</h4>
<p>tl;dr: Rustwide + Libra = cryptographic proofs of BFT consensus around reproducible builds</p>



<a name="182810802"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/182810802" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#182810802">(Dec 06 2019 at 22:22)</a>:</h4>
<p>some interesting stuff here re: reproducing rustc <a href="https://github.com/rust-lang/rust/issues/34902#issuecomment-562698593" target="_blank" title="https://github.com/rust-lang/rust/issues/34902#issuecomment-562698593">https://github.com/rust-lang/rust/issues/34902#issuecomment-562698593</a></p>



<a name="183096073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183096073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183096073">(Dec 10 2019 at 19:59)</a>:</h4>
<p>The README for Synchronicity does not describe what problem does it solve</p>



<a name="183329427"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183329427" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183329427">(Dec 13 2019 at 05:12)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> the general notion of the property is "binary transparency", but I think it provides something a bit stronger</p>



<a name="183329438"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183329438" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183329438">(Dec 13 2019 at 05:12)</a>:</h4>
<p>I can perhaps make a note of it</p>



<a name="183352819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183352819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183352819">(Dec 13 2019 at 12:09)</a>:</h4>
<p>When I read that README I don't understand what use cases that enables. I guess with this tool a few companies can get together, build all crates on <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a> and then tell if the build is reproducible or not, and if yes what the hash is? And ideally I'd be able to get a build environment these guys use and obtain a binary with the same hash myself? This I get. But, what problem does <em>that</em> solve?</p>



<a name="183386335"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386335" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386335">(Dec 13 2019 at 18:37)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> aah, the main use would be binary releases of crates that could be validated in some way, or a global build cache</p>



<a name="183386348"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386348" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386348">(Dec 13 2019 at 18:37)</a>:</h4>
<p>I should probably write a blog post</p>



<a name="183386425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386425">(Dec 13 2019 at 18:38)</a>:</h4>
<p>or a few bullet points in the readme on what use cases that enables</p>



<a name="183386437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386437">(Dec 13 2019 at 18:38)</a>:</h4>
<p>our real goal is to have an excuse to play with HotStuffBFT at the moment, so it’s a bit of a hammer in search of nails 😅</p>



<a name="183386449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386449">(Dec 13 2019 at 18:38)</a>:</h4>
<p>and yeah sure</p>



<a name="183386471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183386471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183386471">(Dec 13 2019 at 18:38)</a>:</h4>
<p>or a “Why does this help?” section</p>



<a name="183674071"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183674071" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183674071">(Dec 17 2019 at 18:06)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> how's this <a href="https://github.com/iqlusioninc/synchronicity/pull/18/files" target="_blank" title="https://github.com/iqlusioninc/synchronicity/pull/18/files">https://github.com/iqlusioninc/synchronicity/pull/18/files</a></p>



<a name="183680736"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Reproducible%20builds/near/183680736" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Reproducible.20builds.html#183680736">(Dec 17 2019 at 19:15)</a>:</h4>
<p>Probably too technical to actually get people excited about it, but good as a first pass</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>